For decades, the phrase "too big to fail" belonged exclusively to banks. Regulators built entire post-crisis frameworks — stress tests, resolution regimes, systemically important institution designations — around the premise that a handful of oversized lenders could bring down entire economies if left to collapse. Now, as financial analyst Chris Skinner argued this week in his long-running The Finanser blog, the same existential logic has migrated to a new class of institution: the hyperscale cloud technology companies. And the financial system, largely without public debate, has let it happen.
The provocation at the heart of Skinner's October 19–25 edition is blunt and uncomfortable: when Google goes down, your bank goes down. That is not hyperbole — it is an increasingly accurate description of how modern retail and institutional banking infrastructure is architected. Core banking migrations to public cloud, API-driven open banking layers, real-time payment rails and fraud-detection engines are all, in growing proportion, hosted on a small number of commercial cloud platforms. The concentration is remarkable in its scope and underappreciated in its systemic risk implications.
The question Skinner poses — "Who is really in control?" — is deceptively simple but operationally profound. A licensed, regulated, capital-adequacy-tested bank may sit at the front of the customer relationship, but its ability to process a payment, authenticate a login, run a credit decision, or even open its digital doors on a Monday morning is increasingly contingent on the uptime, security posture, and commercial continuity of a cloud vendor that answers to no financial regulator. The governance gap between where accountability formally resides and where operational power actually lives has never been wider.
This is not a theoretical concern confined to fintech commentary circles. Regulators across major jurisdictions have been circling the problem for several years. The European Banking Authority (EBA) has pressed for enhanced oversight of critical third-party providers, and the European Central Bank (ECB) has repeatedly flagged cloud concentration risk in its financial stability reviews. In the United Kingdom, the Bank of England's operational resilience framework compels firms to identify "important business services" and prove they can deliver them through severe but plausible disruption scenarios — including the loss of a major cloud provider. The Bank for International Settlements (BIS) has published research documenting how a single cloud outage could simultaneously impair thousands of financial entities sharing common infrastructure.
Yet regulatory concern has not translated into structural change. The commercial logic pulling banks toward a small number of hyperscalers — cost efficiency, engineering talent density, global scale, advanced artificial intelligence tooling — remains overwhelming. A mid-tier retail bank that spent hundreds of millions on private data centers over the past decade is now watching cloud-native neobanks operate at a fraction of its cost base. The competitive pressure to migrate is acute, and the negotiating leverage to demand bespoke resilience commitments from the largest cloud providers is, for most banks, essentially zero. You take the service level agreement on offer or you fall behind your competitors.
The "too important to fail" framing that Skinner applies to this moment is instructive precisely because it exposes the asymmetry at play. When a bank was deemed systemically important, regulators could demand more capital, more liquidity, living wills, and recovery plans. When a cloud provider is systemically important to the entire financial system, regulators have far fewer tools. The providers are not banks. They do not hold deposits. They are not licensed credit institutions. The standard prudential toolkit does not fit, and the effort to craft bespoke oversight frameworks has proceeded at a pace that the pace of cloud adoption has long since outstripped.
There is also a geopolitical dimension that Skinner's framing implicitly surfaces. The handful of technology companies that now serve as the de facto utility layer of global banking are overwhelmingly headquartered in a single country, subject to its legal jurisdiction, and — in extremis — subject to its executive authority. European, Asian, and emerging-market banks that have migrated core operations to these platforms have, in effect, introduced a layer of foreign sovereign risk into their operational architecture that no pre-crisis stress test ever contemplated.
What This Means for Banks, Regulators, and the Cloud Giants
The candid answer to Skinner's question — who is really in control — is that control is now genuinely shared between institutions that carry legal accountability and platforms that hold operational reality. That is an unstable arrangement, and its fragility will eventually be tested in ways that a routine outage cannot fully simulate. The path forward demands three things simultaneously: regulatory frameworks that extend meaningful oversight to critical technology providers without stifling the innovation benefits they deliver; commercial pressure from large banking clients — exercised collectively where individual leverage is insufficient — to enforce genuine multi-cloud resilience standards; and a frank industry-wide acknowledgement that the cloud is no longer a vendor relationship. It is infrastructure. And infrastructure this important cannot be governed through a standard procurement contract and a quarterly service review. The "too important to fail" lesson was painful the first time. Learning it again in a cloud-dependent financial system would be costlier still.
Written by the editorial team — independent journalism powered by Codego Press.